ramnit | f5f57c8d450d8fc9ddad6586d8341ecc9715ea8bb319b3896d7d68d75dcd4e94

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
Size

155KB
MD5

1a0f9155a2185e5ed2f13744487d2bcd
SHA1

db4cd0e79abd5b3b4fa6ece3dd23ef1c13dd5299
SHA256

f5f57c8d450d8fc9ddad6586d8341ecc9715ea8bb319b3896d7d68d75dcd4e94
SHA512

cd4499584b1eaeda2a25adbcd38e478b2cfd5ebbe1320250de9e92a744034352d2e7940a328be03793f4fd0bd571eb3e8cdcd26d864d99a483d554b9a5c5bdc1
SSDEEP

1536:BaMmKEB9SeVOkNV9qpAUY539HpWwmgNkww5lx5lvLvEWgDAgvWSrnunHm/VTFZT+:b29xzP53PWwnzelxEA8ruHmdTLN17DW

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/2148-0-0x0000000000400000-0x0000000000461000-memory.dmp upx
behavioral1/memory/2148-6-0x0000000000400000-0x0000000000461000-memory.dmp upx
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

pid process

2148 1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148 1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148 1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/2148-6-0x0000000000400000-0x0000000000461000-memory.dmp	upx

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

pid	process
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2148 1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
Token: SeDebugPrivilege 2148 1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
Token: SeDebugPrivilege	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe

description	pid	process	target process
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 380	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	wininit.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 392	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	csrss.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 432	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	winlogon.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 476	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	services.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 492	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsass.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 500	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	lsm.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 596	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 668	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 744	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 808	2148	1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:808

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:112

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:348

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:2312

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:3016

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a0f9155a2185e5ed2f13744487d2bcd_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2148-4-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2148-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2148-2-0x0000000076F80000-0x0000000076F81000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x0000000076F7F000-0x0000000076F80000-memory.dmp

Filesize
4KB

Download
memory/2148-6-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download